I'm trying to do some csrf attack test on a site.
I found that the site protect itself from csrf by checking the http Origin header.
But I guess maybe under some conditions I can bypass the protection. The website just check if the request has the Origin:
header set to https://example.com
-
Is it possible to set a custom Origin header in the browser using some php code?
<?php header('Origin: https://example.com'); ?> +csrf-code
How can i spoof the origin header myself or convince victim browser to do that? The server checks theOrigin:
header and if it's notexample.com
throws a 500 error message while if it's set tohttps://example.com
the csrf works fine.